Skip to content

Update some dev-dependencies to fix vulnerability issues #1275

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Aug 21, 2024

Conversation

Kocal
Copy link
Member

@Kocal Kocal commented Aug 21, 2024

We have some vulnerability alerts raised by Dependabot https://github.com/symfony/webpack-encore/security/dependabot?q=is%3Aopen+manifest%3Ayarn.lock

The PR won't impact the end users, they probably already updated the dependencies themselves, it's only some maintenance... :)

The following dependencies are updated to their patched version:

  • braces
  • webpack-dev-middleware
  • express
  • follow-redirects

The following dependencies are not updated, as it requires major updates that can break user-land:

  • ws, used by webpack-dev-server (need one major update)
  • @adobe/css-tools, used by stylus (needs three major updates)
  • tough-cookie and request, used by the archived package zombie, there are no new releases, so we must find a replacment
  • vue-template-compiler, we must drop Vue 2 support before

@Kocal Kocal merged commit c3a7584 into symfony:main Aug 21, 2024
28 checks passed
@Kocal Kocal deleted the chore/upd-vuln-deps branch August 21, 2024 21:52
@Kocal Kocal modified the milestones: 5.0, 4.17 Aug 22, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant